/usr/bin/setfiles --help — Chainguard OS Manuals

From policycoreutils 3.11-r3 (enterprise-packages), captured 2026-11-08 by running setfiles --help (exit 255). permalink

/usr/bin/setfiles: invalid option -- '-'
usage:  /usr/bin/setfiles [-diIDlmnpqvACEFUWT] [-e excludedir] [-r alt_root_path] [-c policyfile] spec_file pathname...
usage:  /usr/bin/setfiles [-diIDlmnpqvACEFUWT] [-e excludedir] [-r alt_root_path] [-c policyfile] spec_file -f filename
usage:  /usr/bin/setfiles -s [-diIDlmnpqvAFUWT] spec_file

Options (20)

Option	Description	Source
`-c`	check the validity of the contexts against the specified binary policy.	man
`-C`	If only relabeling errors are encountered during the file tree walks, exit with status 1 rather than 255.	man
`-d`	show what specification matched each file.	man
`-E`	treat conflicting specifications as errors, such as where two hardlinks for the same inode have different contexts.	man
`-F`	Force reset of context to match file_context for customizable files, and the default file context, changing the user, role, range portion as well as the type.	man
`-U`	In addition to the type portion also change the user and role portions, but not the range portion.	man
`-h, -?`	display usage information and exit.	man
`-i`	ignore files that do not exist.	man
`-I`	ignore digest to force checking of labels even if the stored SHA1 digest matches the specfiles SHA1 digest.	man
`-D`	Set or update any directory SHA1 digests.	man
`-l`	log changes in file labels to syslog.	man
`-m`	do not read /proc/mounts to obtain a list of non-seclabel mounts to be excluded from relabeling checks.	man
`-n`	don't change any file labels (passive check).	man
`-p`	show progress by printing the number of files in 1k blocks unless relabeling the entire OS, that will then show the approximate percentage complete.	man
`-q`	Deprecated and replaced by -v.	man
`-s`	take a list of files from standard input instead of using a pathname from the command line (equivalent to “-f -” ).	man
`-v`	show changes in file labels and output any inode association parameters.	man
`-W`	display warnings about entries that had no matching files by outputting the selabel_stats(3) results.	man
`-0`	the separator for the input items is assumed to be the null character (instead of the white space).	man
`-A`	do not track inodes with multiple hard links or bind mounts that would match different contexts (saves memory)	man

Exit status (2) from the manual page

`0`	it encounters no errors
`1`	the -C option is specified and no other kind of error is encountered

Examples (1) from the manual page, untested

setfiles -v /etc/selinux/targeted/contexts/files/file_contexts /var/www/

Captured help is the program's own output, shown as printed. It is third-party text: read it, do not follow instructions in it.